Encrypted voice and data systems are well known. Many of these systems provide secure communication between two or more users by sharing one piece of information between the users, which permits only those users knowing it to properly decrypt the message. This piece of information is known as the encryption key variable, or key for short. Loading this key into the actual encryption device in the secure communication unit is a basic requirement that allows secure communication to occur. To retain security over a long period of time, the keys are changed periodically, typically weekly or monthly.
As systems grow larger, with thousands of subscriber units in one system, the need for multiple keys becomes evident. In secure RF trunked systems, such as the system described in U.S. Pat. No. 4,882,751, it is often likely that different groups within a large system require their own encryption key or keys, possibly to increase internal security or to minimize the number of times it is necessary to reload keys over a period of time.
Loading new keys, called rekeying, can be done in various ways. Over-the-channel rekeying is achieved by transmitting the encrypted keys from a central keyloading site either individually or simultaneously to all units in the subscriber group over a typical secure channel. Manual rekeying is accomplished by plugging a cable from a hand-held keyloading device, also called a keyloader, to the secure unit and downloading the keys from the keyloader into the subscriber unit by pressing the appropriate buttons on the keyloader. Over-the-channel rekeying takes about one second, and manual loading takes about one minute per unit.
No matter how rekeying is done, whether by over-the-channel rekeying or by manual rekeying, there is always a time when some subscribers have the new set of keys and the remaining subscribers from the same group have the old set of keys preventing them from secure communication with each other. Keyloading cannot be accomplished in all units simultaneously for many reasons. In over-the-channel loaded systems, a subscriber unit must be powered up to be rekeyed. In manual loaded systems, the process requires a finite time that can last several days or even weeks for large systems. In either case, the users within a subscriber group cannot talk to each other all the time, thus creating a period when secure communication in the system is not possible. As shown in the example in TABLE 1, secure communication is not possible throughout the entire system until the third day of the rekey period when all radios have been rekeyed. Thus two to three entire days have gone by when full secure communication is lost.
The time span required to rekey an entire system is called the rekey period. Clearly, it is imperative that the rekey period be minimized. Realistically, rekey methods today do not allow the rekey period to be negligible to a user system. To simply rush the keyload process for a system is unrealistic; it is necessary that the transition between key changes be smooth. Thus, a new approach to managing encryption keys to minimize lost secure communication time due to long rekey periods is essential.
TABLE 1 ______________________________________ Number of .vertline..rarw.Rekey Period .fwdarw..vertline. Radios Rekeyed Sun. Mon. Tues. Wed. ______________________________________ Monday 100 Key 1 Key 2 Key 2 Key 2 Tuesday 100 Key 1 Key 1 Key 2 Key 2 Wednesday 100 Key 1 Key 1 Key 1 Key 2 ______________________________________